Is there a script or process that you can push from the JSS that shows you who is a Administrator on their Mac? If I have 2,000 users and maybe I gave them admin access for some reason and forgot to take it back how can I tell without going to each machine?

I'm looking for a way to use oascript to set the values of buildings, departments and extension attributes in the form of drop downs so the "jamf recon -building, -Department, etc" commands can be executed with what was selected from the dropdown. My goal is to have a technician who doesn't have access to the Jamf admin console, the ability to set these quickly and easily. It's possible that I have to use the API but I'm not sure.

I am encountering the following problem: Wenn enrolling a MacBook Pro (10.15.3) using the pre-stage enrollment I end up with 2 users:501 - jamfAdmin (Configured in the pre-stage enrollment payload)502 - local Admin (Configured Manually during the Setup) The problem is that neither of these users has a secure token.Trying to grant my local admin a secure token, does not work either as the local admin does not have a secure token unlock. According to the following blog post: https://travellingtechguy.eu/macos-catalina-secure-tokens-part-1-local-accounts/My created user should get a secure token. Is anybody else experiencing the same problem or has some insight, as to why this issue is occurring.

JAMF Nation folks! I am in need of some advice on how to restart a computer within a if-else/else-if loop of a JAMF Helper script. The script's purpose is to perform software and security updates and then reboot the computer if the user decides to opt in. If not, an echo command is sent and they'll be prompted again the following day. The opt-in and opt-out portions work great and the updates are applied. The only issue here is with the actual restarting of the computer. if [ "$userChoice" == "0" ]; then echo "User clicked UPDATE; now downloading and installing all available updates." softwareupdate --install --all osascript -e 'tell application "System Events" to restart' elif [ "$userChoice" == "2" ]; then echo "User clicked Cancel or timeout was reached; now exiting." exit 0 fi The problematic line is osascript -e 'tell application "System Events" to restart'. An error is generated as well within the JSS logs. Here's the error that is received. 36:43: execution

I looked through the existing discussions about this topic but there weren't any that fit the issue I am having. Our process for deploying Adobe CC is creating a package using Adobe Admin Console, downloading that package and running the downloader file, copying that package over to Jamf Admin. From there we create an install policy and scope that policy to the machines that we want to install the software on. Everything has been running smooth with no issues. That is until I tried to run that policy on an iMac with Catalina 10.15.I noticed that the software had not installed so I checked the logs on that policy and on the machine name that has 10.15 is just says pending. It has been that way for four days. I then tried running the "sudo jamf policy -verbose" command in Terminal and I received the following result (See attached image).I have run this same exact process on iMacs with 10.13 and 10.14 with no issues. I am in need of some help. I have got to get this one figured ou

Hi guys, I am using dscl . read to create an array with users in the Admin Group. However, its not giving me what I want. I want each user in the Admin Group to be a separate element in the array. How do I do that? I tried using cut -d " " but that didn't work #Users Array - All users in Admin group USERS=$( dscl . -read Groups/admin GroupMembership | cut -c 18- ) Output: USERS=([0]="root admin1 admin2") Desired Output: USERS=([0]="root" [1]="admin1" [2]="admin2")

Hello all, I'm trying to edit a .plist file to for Symantec Cloudsoc Reach agent application. editing the .plist file will automatically open the default browser for user authentication. The Reach agent gives you the option of automatically launching the default browser to initiate user authentication with CloudSoC. Otherwise, the Reach agent uses its own pop-up window to prompt the user to click the authentication URL to initiate the login process. On Mac, I would have to give the ShowAuthPopup key a string value of 0 in the ReachAgentConfig.plist file at the following location: /Library/Application Support/ReachAgent/ReachAgent.app/Contents/Resources/ For example: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ShowAuthPopup</key> <string>0</string> &

I used the Adobe CCP to create an uninstaller, and it generaated a binary executable file, as shown in attached pic. Anyone know the best way to deploy such a file?

I was watching a Jamf webex and saw a policy to update asset tag via self service. I really like the idea for support staff. Has any one done something like thing? Am going to guess its done via the API.

Hi, I'm trying to report on which of out machines don't have Meraki Agent installed. I have created Extension Attribute and used a Smart Group but its not showing any machines as having Meraki Agent. What am I doing wrong? The script works in Terminal #!/bin/bash PROFILE_ID="com.meraki.sm.mdm" if ( /usr/bin/profiles -P | /usr/bin/grep -q $PROFILE_ID ); then # Profile is present echo "<result>True</result>" exit 1 else # Profile isn't there, need to install echo "<result>False</result>" exit 0 fi

Hello, We upgraded to JSS 10.14.1 Friday, just before 10.15.1 dropped. We have a few 10.11 clients, so opted for 10.14.1 until we bump off the final El Capitan machines. Can anyone confirm 10.11 clients are working with JSS 10.15.1? I am not looking to re-enroll 10.11 Macs, just hoping current clients still function with JSS. Thanks, and may the force be with you.

Beginner scriptor in need of some assistance. I basically pieced this script together from two other scripts, it fails when I run this and works when separated. This is the error I receive when running the script, which I'm guessing is a syntax error. Any help would be greatly appreciated! Script exit code: 2 Script result: /Library/Application Support/JAMF/tmp/Delete User Profiles Older than 1 day: line 19: unexpected end of file Script #!/bin/bash # Delete User Profiles in /Users. Exclude the 'Shared' account. oldUsers=`find /Users -type d -mtime +1 -maxdepth 30 | cut -d"/" -f3` for oldUsers in `ls /Users | grep -v Shared` do if [[ $oldUsers == `ls -l /dev/console | awk '{print $3}'` ]]; then echo "Skipping user: $username (current user)" else echo "Removing user: $username" # Optional, removes the account dscl . delete /Users/$username # Removes the user directory

Hello All, I know this has been discussed elsewhere but the discussions are older and I am wondering if anyone has found a better solution: I am trying to configure 4 Scholastic Reading Apps on iPads. 2 of the Apps (Stage B: Read180 and SRI) accept and hold the Site ID with no issues but SRC and rSkills will not hold the Site ID. A previous thread suggested adding a script in the App Configuration on JSS but this has not worked for me. (previous thread: https://jamfnation.jamfsoftware.com/discussion.html?id=11922) Scholastic is unable to replicate the problem on their end and my teachers are getting very frustrated. Does anyone have any suggestions or anything that has worked for them?

Hi guys I am tryin to blocked some certain SSIDs. I was wondering if someone ca help me with variable for all the SSIDs. so far this works #!/bin/sh # Prevent Access to RLSPOT001 SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I | grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '` if [ $SSID = "RLSPOT001" ]; then /usr/sbin/networksetup -setairportpower en1 off fi # Prevent Access to RLAVID001 SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I | grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '` if [ $SSID = "RLAVID001" ]; then /usr/sbin/networksetup -setairportpower en1 off fi # Prevent Access to RLSHEE001 SSID=`/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I | grep ' SSID:' | cut -d ':' -f 2 | tr -d ' '` if [ $SSID = "RLSHEE001" ]; then /usr/sbi

Hi! We're deploying Backblaze to our users so they can be backed up. They gave me a line to go in a script to set the private key for the users automatically. What's the best way to get this working? The part they gave me was, "/Library/Backblaze.bzpkg/bztransmit -setprivkey none <hexencodedkey>" with the <hexencodedkey> going to be filled in with what we want to use.

Hello guys, i know this question have been asked and answered. I have been reading a lot of posts on here and there is no universal step by step instructions that i could find. People are saying that some times script is not working, or the results are not consistent in the environment. I am new to all of this. I have been tasked to upgrade some of the devices that still on High Sierra to Mojave and it needs to be done via self service.I don't want to assume that those devices have Mojave cached, therefore i think i would need to create a package that would get pushed to Application Folder ( I am trying to find out how to do that, so far no luck)Second i know for a fact that users do not have admin rights, so this needs to be taking in to consideration when doing upgrade. I know there are multiple links to a script that is about a page long on GitHub and there are one liners commands that can perform the upgrade. Given my scenario which route should i take? Long Script or one liner? A

I realise I am leaving this a little bit late with Catalina just around the corner, but what I really need is to be able to produce a spreadsheet of what 32 Bit Apps are installed on my Mac fleet, with details of which Mac they are on etc. I am suprised there is not more chat on here about this- hopefully it's because there is an easy solution which I've overlooked! I have rrouton's script to create a document on each Mac detailing the 32 bit Apps https://derflounder.wordpress.com/?s=32bit but I can't get this to work as an EA as others seem to be doing. How is everyone else managing this? We do a lot of scientific computing here, and I suspect there are many 32 bit apps in use. Thanks in advance!

Hello, Our JSS ran out of space over the weekend. I've cleared some old log files and rebooted. Now the JSS is stuck at " Checking for tables to rename..." I figured before opening a support ticket, I'd check here to see if there was something quick to try.

Please excuse the length - part of this post is brainstorming for my own benefit. and part of it is documenting what all I have tried. Environment:10.8/10.9 client machines10.6.8 OD serversOpenLDAP serversJSS 9.32Mobile accounts with no syncing (so just local storage) The client machines are currently bound to the 10.6.8 servers. A previous admin was using createmobileaccount scripts to create mobile accounts, and I found this was causing problems where credentials were not being cached on the client machine. I know the documentation all says that the credentials should be cached on first good login when the server is available, but I could image machines with the createmobileaccount script, log into the mobile account while connected to the network, and then be unable to log into the account if I pulled the ethernet cable. This was resolved when I went to a Configuration Profile pushed down to the client machines. Mobile accounts were being created correctly and the credentials wer

I had a fun experience yesterday going from 10.8 -> 10.14 on redhat linux. Long story short I had to revert to 10.8. I worked with support on it and apparently there are some problems upgrading to 10.14. Has anyone got it working? If so, what OS is your Jamf Pro hosted on, along with the version you were upgrading from. Thanks in advance!

We can query users that our in our on-prem LDAPS server within Jamf Cloud just fine, but when we enable Require Authentication for Prestage Enrollment and the user enters in their LDAPS account on a new Mac, the computer thinks about those credentials for ~10 minutes before finally accepting them. However, if the password is entered incorrectly, it's immediately marked as wrong without waiting for 10 mintues. It's kind of ridiculous. Not sure what I can do to reduce that waiting time for end users

Having an issues with a user on site who is using a mac with a local account however wants to be able to print to our network printers. I have added the printer on his machine and the first time typed in his domain credentials in and saved it in the keychain I then tested that all jobs were being sent correctly. However, after a few hours they are having the Hold for Authentication error and when clicking on this to be prompted for their password again get nothing. I have checked in the keychain and all details are correct. The only thing i can think of is that the local accounts username is different to their domain username. Could it be trying to use this username instead after a period of time? Any Help would be greatly appreciated.

Is there any way to search in JAMF or create some sort of inventory report that can identify computers that have external hard drives attached? We'd like to be able to identify which of our users are using external drives and whether or not those drives are encrypted.

Silly question - If I download the Catalina.app and package it up with Composer - Upload it to my JSS, and then create a policy to cache it on a target machine do I want to choose that package and say "Cache" or "Install"? The reason I ask is that - wouldn't I want to "install" the PKG that I made so that it "places" the installer into the users applications folder? ...or am I overanalyzing this and I should just say "cache" - I was under the impression that that would put the PKG someone on the target machine but not "run" it

Hello, I'm trying to configure NoMAD through Jamf for all of the machines I run, but I'm running into a snag since the config has to be in the local users' home directory and I'm hoping someone here can provide some insight. I found a login script from a user (Thanks @PaulHazelden) last year which is listed here: AD_domain="your ad server" Realm="YOUR AD SERVER" # Write default AD domain defaults write com.trusourcelabs.NoMAD ADDomain -string "$AD_domain" defaults write com.trusourcelabs.NoMAD KerberosRealm -string "$Realm" defaults write com.trusourcelabs.NoMAD UseKeychain -bool "true" defaults write com.trusourcelabs.NoMAD SignInWindowOnLaunch -bool "true" defaults write com.trusourcelabs.NoMAD UPCAlert -bool "true" defaults write com.trusourcelabs.NoMAD UseKeychainPrompt -bool "true" My problem is that scripting this through Jamf results in the defaults command writing to the roo